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c OR MOST SITUATIONS IN WHICH FAULT CONDITIONS 
ARE POSSIBLE, A FAULT-PROTECTED SWITCH, MULTI- 
PLEXER, OR SIGNAL-LINE CIRCUIT PROTECTOR OFFERS 
A MORE PRACTICAL APPROACH TO PROTECTION THAN 
DISCRETE COMPONENTS. 

Fault protection saves 
multiplexers, switches, 
and downstream circuitry 



When the voltage at an input of a switch, 
multiplexer, or signal-line circuit protector 
exceeds the voltage that powers those devices, 
you define the excessive input voltage as a fault. This 
definition also applies if the power supplies are off. 
In this case, any nonzero voltage appearing at an in- 
put is a fault. 

Faults happen for many reasons. For one, equip- 
ment owners with access to an external connector 
can inadvertently connect a high voltage through the 
connector to a switch, multiplexer, or circuit-pro- 
tector input that is inside the equipment. Faults can 
also occur when a sensor or other device fails, short- 
ing the high- voltage supply that powers the device 
to the device's output, which connects to a switch, 
multiplexer, or circuit protector. Fault voltages can 
also occur when multiple supplies provide power for 
the switch, multiplexer, or circuit protector and the 
surrounding circuitry. Faults are possible if these 
supplies don't follow the proper power-up and 
-down sequencing. 

PROTECTION FOR MULTIPLEXERS 

An aircraft hydraulic system provides an exam- 
ple of fault voltages that result from component fail- 
ure (Figure 1). In this case, a computerized alarm 
generator and a cockpit display scan multiple pres- 
sure sensors. When a transducer fails and shorts the 
full aircraft-battery voltage of 28V to its output, 
damage happens not only to the multiplexers, but 

so to the downstream alarm and cockpit-display 
circuitry. Under this fault condition, aircraft engi- 



neers, of course, want to avoid component damage, 
regardless of whether the multiplexers have power. 
But they also want to ensure that pilots can contin- 
ue to accurately read the measured pressure and hear 
the alarms that the working pressure transducers 
generate. Further, in the event that the alarm or the 
cockpit-display circuitry loses power, the circuitry 
that still has power must continue to properly read 
the hydraulic pressure. Aircraft engineers impose 
this condition not only to improve flight safety, but 
also to allow accurate readings during mainte- 
nance — when power to any component can be on or 
off at random. 

When the circuit or the system subjects a standard 
multiplexer to this 28V fault voltage, the multiplex- 
er not only incurs damage, but also passes the high 
voltage to the nonfaulted side of the multiplexer. 
Also, when a fault appears at an off channel, current 
injects into the substrate of the multiplexer, render- 
ing the on channel inaccurate. Finally, when you re- 
move power to one of the multiplexers, the multi- 
plexer loads the signals from the sensors. 

To deal with some or all of these problems, sever- 
al fault-protection schemes have emerged over the 
years. A common remedy is to add resistors in se- 
ries with the multiplexer inputs (Figure 2). This 
scheme limits to safe levels the current that flows into 
the multiplexer's input-protection diodes when a 
fault occurs. Typically, two protection diodes are 
present at each input. The anode of one diode con- 
nects to the input, and its cathode connects to the 
positive supply; the cathode of the other diode con- 
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nects to the input, and its anode connects 
to the negative supply. These diodes pre- 
vent voltages at the input from ranging 
beyond a diode drop above the positive 
supply and beyond a diode drop below 
the negative supply. These diodes protect 
against ESD voltages and voltages that 
originate from relatively high-impedance 
sources. The diodes do not protect 
against constant fault voltages 
from low-impedance sources un- 
less you add a series resistor. The speci- 
fied maximum allowable continuous 
current for a multiplexer pin is a rating 
of the current-handling capability of the 
protection diodes connected to that in- 
put. You'll find this number in the Ab- 
solute Maximum Ratings of the multi- 
plexer data sheet. 

For the circuit of Figure 2, the worst- 
case current through the protection 
diodes occurs when the power to the mul- 
tiplexer is off at OV and when the 28V 
supply reaches its upper tolerance of ap- 
proximately 36V. Under these conditions, 
the 3.9-kfi resistors limit the current to 
less than 10 mA. The current through the 
protection diodes is actually closer to half 
this amount, because two protection 
diodes parallel each other in this situa- 
tion. For each of the inputs that you tie 
together, the diode that connects to the 
positive rail at one input parallels the 
diode that connects to the positive rail at 
the other input. Because data sheets di- 
vulge little about the characteristics of 
protection diodes, you can assume that 
these diodes are so poorly matched that 
one diode steals all the current from the 
other. Thus, this circuit uses 3.9-kfi re- 
sistors, which limit the current to less than 
1 mA with a 36V fault when the positive 
supply is 0V and assuming that one of the 
two paralleled diodes takes all the current. 

This scheme also protects the down- 
stream circuitry, because the resistors pre- 
vent damage to the multiplexer's input- 
protection diodes, which thus continue to 
limit the voltage to the downstream cir- 
cuitry to a diode drop outside the supply 
rails. However, this protection scheme 
can't protect against certain errors when 
a fault isn't present. If power is off at one 
multiplexer, its protection diodes usually 
connect to 0V via the off supplies. The 
protection diodes within that multiplex- 
er that connect to the positive supply, 
which is now at 0V, conduct enough cur- 
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MAX309 OR MAX379 

NOTES: 

MAX309=STANDARD DUAL 4:1 MULTIPLEXER. 
MAX379=FAULT-PR0TECTED DUAL 4:1 MULTIPLEXER. 

An aircraft-hydraulic system illustrates the need for fault protection. A short circuit through : 
sure sensor can cause 28V to come into direct contact with the multiplexers. 



rent through the 3.9-kfi resistor to cause 
an error of several volts. To fix this prob- 
lem, you can double the number of pro- 
tection resistors by connecting one resis- 
tor to each multiplexer input. 

SERIES RESISTORS HAVE A DOWNSIDE 

These protection resistors, unfortu- 
nately, add to the effective source resist- 
ance, which, in concert with the multi- 
plexer's input leakage, increases the error 
voltage. Also, if a fault occurs in an off 
channel, current flows through the mul- 
tiplexer's substrate, which generates er- 
ror currents in the on channel. These er- 
ror currents reduce the accuracy of the 
measurement. Adding these resistors in- 
creases the circuit's size and impedance 
level, which makes it more susceptible to 
noise pickup. 

Two other problems can affect circuit 
performance when you add these resis- 
tors, although not for this application. 
First, the circuit loses some bandwidth 
but usually not enough to hamper most 
applications. The aircraft-hydraulic ap- 



plication, for example, operates at dc. As- 
suming about 3 pF of input capacitance 
and a 3.9-kfl resistor at each input — un- 
like in Figure 2, for which two channels 
share a resistor — each channel's band- 
width decreases to about 13 MHz. Sec- 
ond, these resistors create inaccuracies 
due to voltage-divider losses. In this ap- 
plication, however, the high input im- 
pedance of the instrumentation ampli- 
fier prevents any appreciable vol- 
tage-divider effects from occurring. 

When a number of 28V fault voltages 
simultaneously appear at the multiplex- 
er inputs, the current that flows through 
the internal protection diodes that con- 
nect to 1 5V can drive up this supply volt- 
age. Similarly, negative fault voltages can 
drive the —15V supply more negative. 
The circuit in Figure 3 protects against 
both this problem and the problem of 
substrate current flow. In this circuit, re- 
sistor/diode networks clamp the multi- 
plexer inputs below the supply voltages, 
limiting the voltage at the multiplexer in- 
puts and eliminating current flow 
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through the multiplexer's protection 
diodes. When power to the multiplexer is 
on, a fault to the circuit does not send 
current into the substrate. Thus, off- 
channel faults don't affect the channels 
that are on. Also, because no current 
flows through the protection diodes, 
fault voltages can't affect the supply volt- 
ages via that path. 

The circuit uses low-leakage silicon 
diodes for the clamps. You should avoid 
using Schottky diodes because their leak- 
age currents create an appreciable volt- 
age drop across the 3.9-kft resistors. Us- 
ing low-leakage silicon diodes alone 
doesn't do the trick, however. 

When these diodes connect di- | _fj 

rectly to the ±15V supplies, their for- 
ward voltage drops of approximately 
0.65V allow a fault voltage to exceed the 
absolute maximum rating of the multi- 
plexer inputs, which is usually 0.3V above 
the rails. Thus, the circuit uses two 
1N4105 zener diodes to drop the supply 
voltages for the silicon diodes to ± 1 IV. 

Note that two 3.9-kfl resistors bias the 
zener diodes. It might be tempting to 
leave the zeners unbiased, relying instead 
on fault voltages to bias them when a 
fault occurs. However, leaving these 
diodes unbiased creates problems, be- 
cause a zener that isn't reverse-biased 
draws leakage current below the thresh- 
old. If that leakage current flows through 
the circuit, this current would create an er- 
ror that varies with temperature and the 
zener's applied voltage. 

The major problem with this clamp 
technique is the number of components: 
10 3.9-kfl resistors, 16 1N6099 diodes, 
and two 1N4105 diodes. Board space, 
cost, and reliability concerns arise with so 
many parts. Also, removing power from 
one multiplexer loads the other multi- 
plexer. You have to add an additional re- 
sistor at each multiplexer input to pre- 
vent this problem. Further, as with the 
circuit in Figure 2, the 3.9-kfl resistors 
add to the impedance of the signal path, 
which increases the chance of noise prob- 
lems. Finally, in certain applications, 
problems can occur due to bandwidth 
limitations and voltage-divider effects. 

REDUCE EXTERNAL COMPONENTS 

An alternative to adding protection 
components to a standard multiplexer is 
to use a fault-protected multiplexer. A 
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NOTES: 

•PROTECTION DIODES SUCH AS THESE ARE PRESENT 
AT EVERY INPUT OF A STANDARD MULTIPLEXER. THIS FIGURE 
ES CONNECTED TO THE TOPMOST INPUT. 



EIGHT RESISTORS ARE NECESSARY TO PROTECT THE MULTIPLEXERS. 
BECAUSE THIS CIRCUIT SHOWS ONLY TWO OF FOUR PRESSURE 
TRANSDUCERS, IT SHOWS ONLY FOUR OF EIGHT 3.9-kfl RESISTORS. 



Adding resistors between the pressure sensors and the multiplexers provides fault protection but 
allows inaccuracies in the nonfaulted multiplexer channels. 



fault-protected multiplexer operates as a 
standard multiplexer, except that it pro- 
tects against fault voltages without the 
addition of external components. When 
the circuit subjects any of the inputs of 
such devices to a fault, the input goes into 
a high-impedance state, limiting the cur- 
rent the inputs can draw. The inputs also 
limit the voltage appearing at the multi- 
plexer's output during a fault, which pre- 
vents damage to downstream circuitry. 
Also, unlike standard multiplexers, these 
devices guarantee a high-impedance 
path from all inputs to the output when 
you remove the power. Thus, a fault that 
occurs when the multiplexer isn't pow- 
ered cannot damage the multiplexer or 
harm the downstream circuitry. 

You could, for example, substitute two 
MAX379 differential four-channel fault- 
protected multiplexers in the circuit of 
Figure 1, allowing protection against 



±75V faults when power to the multi- 
plexer is off. When the ± 15V supplies are 
on, the multiplexer can withstand ± 60V 
fault voltages. 

The major advantages of using a fault- 
protected multiplexer are: 

• All channels turn off when you re- 
move power. 

• Only nanoamperes of current flow 
during any fault condition. 

• During faults, output-signal limits 
are 3V less than the supply voltages. 
Thus, high voltages cannot get 
through the multiplexer to damage 
downstream circuits. 

• Newer fault-protected multiplexers 
allow the output signals to range up 
to the supply voltages. 

• No series protection resistors or 
clamp diodes are necessary. 

• The device protects both as a mul- 
1 as a c 
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NOTES: 

'protection diodes such as these are present 
at every input of a standard multiplexer, 
this figure shows diodes connected to 
the topmost input. 

four more 3.9k resistors and eight more 1n6099 
didoes are necessary to protect the multiplexers, 
because this circuit shows only two of 
four Pressure transducers, it shows only 
the protection components associated with 
those two transducers. 



Protection circuitry prevents the protection 
wise occur in the nonfaulted channels. 



diodes within the multiplexers from turning on during faults, which eliminates the errors that would other- 



• Off- channel faults have no effect on 
on-channel accuracy. 

The disadvantages of using the 
MAX379 are its on-resistance, which is a 
maximum of 4 kfi over the extended 
temperature range, and its inability to 
pass rail-to-rail signals. The MAX379 
passes signals up to 13.5V and down to 
— 12V when powered with ±15V sup- 
plies. The MAX4508 can handle ±25V 
faults with power of ± 15V, but it is in- 
sufficient for a 28V fault. The MAX4508 
exhibits significantly lower on-resistance 
and allows rail-to-rail operation. 

FAULT PROTECTION FOR SWITCHES 

When two or more supplies power a 
system, sequencing them in the wrong 
order can cause fault voltages to appear 



at multiplexer and switch inputs, as well 
as at other components. In Figure 4, a 
sensor assembly connects to another as- 
sembly that includes an spdt switch and 
an ADC. If, for example, the 15 and 
— 15V supplies come up at different 
times, the op amp's output saturates at 
the rail that comes up first, and a fault oc- 
curs even if ±5V power is present at the 
spdt switch. A fault condition also exists 
at the switch if the ± 15V supplies pow- 
er up simultaneously when the ± 5 V sup- 
plies are off. 

The techniques for protecting the mul- 
tiplexer circuit apply equally well to 
switches. Just as with a multiplexer, plac- 
ing resistors in series with the switch in- 
puts protects against damage to the 
switch during a fault. However, these re- 



sistors cause inaccuracies in the other 
switches within the same package that 
don't have a fault condition. When a fault 
voltage turns on a protection diode, cur- 
rent flows into the substrate, which caus- 
es inaccuracies in the nonfaulted switch- 
es. Also, these resistors cause additional 
errors due to leakage currents and volt- 
age-divider effects. 

You must ensure that the circuitry 
downstream from the switch undergoing 
a fault can handle the current that flows 
through the switch under this fault con- 
dition. For the circuit of Figure 4, this 
current isn't an issue because of the rel- 
atively high input impedance of the 
ADC. In circuits for which the switch 
drives a device with low input imped- 
ance, the current during a fault can be 
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significant. The voltage at the switch is a I 

diode drop above the supply volt- I ~ ~~" 

age, and the on-resistance of the ' 



switch essentially determines the current 
that this voltage creates. However, when 
an op amp drives a protection resistor 
and a switch, the current during a fault 
can't usually cause damage, because most 
op amps have relatively limited output- 
current capability. Even without a pro- 
tection resistor, the protection diodes 
within the switch should, in most cases, 
limit the voltage from the op amp to a 
diode drop outside the supply voltages 
that power the switch. Under these con- 
ditions, however, if the op amp resided in 
an SC-70 package, power dissipation 
could become a consideration. Most of 
these same concerns about excessive cur-, 
rent apply to the multiplexer circuits if 
the multiplexer drives a low-impedance 
device instead of an instrumentation 
amplifier. 

Regardless of whether you use a pro- 
tection resistor, a fault causes inaccuracies 
in the nonfaulted switches. You can use 
the protection scheme in Figure 3 to pre- 
vent fault voltages from generating these 
errors. However, the number of compo- 
nents such a scheme requires may be 
prohibitive, and cost, reliability, and 
board real estate become issues. Also, if a 
current-limiting resistor is necessary — 
for example, if the op amp's output can 
source a large amount of current — two 
more problems arise. First, the resistor 
may make the time to charge the ADC's 
sample capacitor prohibitively long. Con- 
version errors result if the ADC samples 
the voltage before the sample capacitor 
has fully charged. Second, ADCs prefer 
low-impedance sources because current 
spikes drawn by the ADC input can cause 
voltage errors at that same input. The re- 
sistance of the current-limiting resistor 
plus the switch on-resistance may be suf- 
ficiently high to cause this problem. 

The simplest approach is to incorpo- 
rate into the circuit a fault-protected spdt 
switch, such as the MAX4632. In this sit- 
uation, this switch is suitable because the 
fault voltage doesn't exceed ± 35V, which 
is the switch's permitted level with a sup- 
ply voltage of ±5V. 

The major advantages to using a fault- 
protected switch are as follows: 

• All switches turn off when you re- 
move power. 

• Only nanoamperes of current flow 
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When several supplies provide power to two assemblies, power-supply sequencing problems can 



All first-generation fault-protected 
switches, multiplexers, and circuit pro- 
tectors are free of latch-up problems. You 
can sequence their supplies in any order 
without causing a latch- up condition, re- 
gardless of whether voltages are present 
on any of the devices' pins. In fact, some 
engineers use fault-protected switches 
and multiplexers, not to protect against 
faults, but simply to avoid latch-up prob- 
lems. Second-generation devices, how- 
ever, cannot tolerate fault voltages on 
their output pins, because those pins 
have internal clamps to the rails. This 
feature does not typically create a prob- 
lem, because most applications require 
fault protection only on the input side. 
Also, if a voltage is present on a control 
pin when these multiplexers' supplies are 
off, the multiplexer can pass an input 
voltage to the output. The magnitude of 
the output voltage equals the voltage on 
the control pin minus a diode drop. Fur- 
ther, both the first- and second-genera- 
tion devices temporarily pass fault volt- 
ages during power-up when using 
bipolar supplies that don't simultane- 
ously power up. Fortunately, under those 
conditions, these devices limit the volt- 



during any fault condition. 

• During faults, output signals don't 
exceed the supply voltages. Thus, 
high voltages cannot get through 
the switch to damage output cir- 
cuits, yet these switches allow signals 
that range up to either voltage rail to 
pass through. The first generations 
of these switches allow a somewhat 
smaller range of signals to pass, 
however. 

• No series protection resistors or 
clamp diodes are necessary. 

• Faults on any other switch within 
the same IC do not affect the accu- 
racy of nonfaulted switches. 

These switches, along with the new 
generation of multiplexers and signal-line 
circuit protectors, allow rail-to-rail signals 
to flow through them. They also exhibit 
low on-resistance. For example, when you 
power the MAX4632 with ±5V supplies, 
the dual-spdt switch's on-resistance at 
room temperature is typically 16011. That 
number drops to 620 when ± 15V sup- 
plies power the IC. Therefore, insufficient 
charging of the sample capacitor and 
problematic voltage spikes at the ADC in- 
put are less likely. 
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Sequencing problems cause fault voltages in circuits without switches and multiplexers (a). A sig- 
nal-line circuit protector provides optimal protection against faults that appear on individual lines 
rather than at switches and multiplexers (b). 



age that passes to the output to less than 
the supply voltage at either rail. In other 
words, a positive fault voltage cannot ex- 
ceed the voltage at the positive supply, 
and a negative fault voltage cannot ex- 
ceed the voltage at the negative supply. 
Third-generation devices will soon be 
available that will allow faults on all pins 
and prevent the passing of fault voltages 
when bipolar supplies don't simultane- 
ously power up. 

FAULT PROTECTION WITHOUT SWITCHING 

Figure 5 shows the same circuit as Fig- 
ure 4 but for a situation that requires no 
switching. Protection is necessary only if 
the op amp can source enough current to 
damage the ADC's protection diodes. It 
may be tempting to use only a resistor to 
limit the current into the ADC's protec- 
tion diodes, because a resistor can limit 
the current into the ADC sufficiently to 
prevent damage to the diodes. However, 
the addition of the resistor will likely ex- 
cessively increase the time to charge the 
ADC's sample capacitor, resulting in er- 
roneous readings. 

A signal-line circuit protector provides 
the required protection in this situation 
(Figure 5b). Signal-line-circuit protec- 
tors are also useful when the inputs of an 
integrated multiplexer/ ADC require 
fault protection. This device protects a 
single circuit path; it provides the same 
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type of protection as a fault-protected 
switch or multiplexer but doesn't switch 
signals. The MAX366 in Figure 5b comes 
with three circuit protectors. With ±5V 
supplies, the MAX366's on-resistance is 
typically 85fl when the input voltage to 
the device is OV. Take care when using 
this device, however, because its on-re- 
sistance rises as the input voltage varies 
from zero, particularly in the negative di- 
rection. With an approximately — 2V in- 
put, the on-resistance rises to 150fl, 
whereas an input of about 2.4V results in 
that same resistance. The MAX4506, 
which is pin-compatible with the 
MAX366, demonstrates a much flatter 
on-resistance but requires a higher bipo- 
lar supply voltage than this application 
provides. □ 
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